arg_max() (aggregation function)

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Finds a row in the group that maximizes ExprToMaximize.

Deprecated aliases: argmax()

Syntax

arg_max (ExprToMaximize, * | ExprToReturn [, ...])

Learn more about syntax conventions.

Parameters

Returns

Returns a row in the group that maximizes ExprToMaximize, and the values of columns specified in ExprToReturn.

Examples

Find the maximum latitude of a storm event in each state.

StormEvents 
| summarize arg_max(BeginLat, BeginLocation) by State

The results table displays only the first 10 rows.

Find the last time an event with a direct death happened in each state showing all the columns.

StormEvents
| where DeathsDirect > 0
| summarize arg_max(StartTime, *) by State

The results table displays only the first 10 rows and first 3 columns.

The following example demonstrates null handling.

datatable(Fruit: string, Color: string, Version: int) [
    "Apple", "Red", 1,
    "Apple", "Green", int(null),
    "Banana", "Yellow", int(null),
    "Banana", "Green", int(null),
    "Pear", "Brown", 1,
    "Pear", "Green", 2,
]
| summarize arg_max(Version, *) by Fruit

Output

Related content

• arg_min function
• take_any function
• take_anyif function